Archives
All the articles I've archived.
20263
September1
Restricted Management AUs in Entra ID break Entitlement Management and PIM. Here's how to fix it.
Microsoft says Entra ID Governance can't manage objects inside a Restricted Management AU. It can, once you scope a role to the right first-party service principal. Entitlement Management, PIM for Groups and Lifecycle Workflows, tested fail → scope → works in a live tenant.
August1
Your Entra ID protected action has a gap
Protected actions lock hard-delete for users. Then you call the same action from an app and it sails straight through. Here is exactly where the wall is, and where it isn't, tested against a live tenant.
May1
Restricted Management AUs in Entra ID: two undocumented paths that actually work
Updated:Restricted Management Administrative Units contain a service principal holding Application.ReadWrite.All — but the design depends on three configurations Microsoft does not document. All three tested against a live tenant with az rest.